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Dated: 26 August 2021 


Subject: TCF Compliance - New Vendor Compliance Programme 


Background 


To protect the integrity of the Transparency & Consent Framework (TCF) and ensure its success 
for the whole industry, we are pleased to announce the launch of the TCF Vendor Compliance 
Programme. 


IAB Europe already operates a CMP Compliance programme, comprising a pre- 
implementation validation stage and a post-implementation enforcement stage - whereby IAB 
Europe monitors live CMP implementations for compliance with the TCF Policies. The CMP 
enforcement process can result in the suspension of the participating CMP from the 
Framework for non-resolved breaches of TCF Policies. 


IAB Europe is now expanding the Compliance programme to Vendors registered for the TCF, 
to identify and enforce against instances of non-compliant Vendor implementations, which 
reduce consumer protection, expose Publishers and Vendors to serious legal risks, and 
undermine the reputation of the TCF in the eyes of regulators and users. In accordance with 
its prerogatives under the_TCF Terms and Conditions, it is incumbent on IAB Europe, as 
Managing Organisation of the TCF, to ensure that the organisations listed as Vendors are in 
fact able to perform in that role in a manner that is compliant with their commitments under 
the TCF Policies. 


Scope of the Vendor Compliance Programme 


In this first iteration of the TCF Vendor Compliance Programme, IAB Europe will audit live 
installations of Vendor technologies as integrated on Publisher properties and focus on 
assessing compliance with the following _TCF policies: 


Chapter III 16 (1) “A Vendor must not store information or access information on a user's 
device without consent, unless the law exempts such storage of information or accessing 
of information on a user's device from an obligation to obtain consent." 


Chapter III 16 (2bis) “A Vendor shall indicate on the GVL the maximum duration of 
information stored on a user's device, including whether such duration may be 
refreshed.” 


Chapter III 13 (6) “A Vendor must not create Signals where no CMP has communicated 
a Signal, and shall only transmit Signals communicated by a CMP or received from a 
Vendor who forwarded a Signal originating from a CMP without extension, modification, 
or supplementation, except as expressly allowed for in the Policies and/or Specifications." 


Chapter III 16 (17) “A Vendor must not transmit personal data to another Vendor unless 
the Framework’s Signals show that the receiving Vendor has a Legal Basis for the 
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processing of the personal data. For the avoidance of doubt, a Vendor may in addition 
choose not to transmit any data to another Vendor for any reason". 


Chapter III 16 (20) "If a Vendor receives a user's personal data without having a Legal 
Basis for the processing of that data, the Vendor must quickly cease processing the 
personal data and must not further transmit the personal data to any other party, even 
if that party has a Legal Basis for processing the personal data in question". 


Please note that while the policies above constitute the focus of this initial phase of the TCF 
Vendor Compliance Programme, IAB Europe will continue monitoring compliance with all TCF 
Policies and adopting enforcement measures where non-compliance is identified, in line with 
its prerogatives under the TCF Policies and Terms and Conditions. 


Enforcement process 


From the 1* of September 2021, the enforcement process will be as follows: 


IAB Europe will regularly monitor top websites in key markets. 

IAB Europe may also act on TCF community reports of issues found in the market or 
submitted via the TCF non-compliance notification form. 

Where a live Vendor installation is found to be in breach of the policies, the following 
process applies: 

o If this is the first, second or third time a breach has been identified, in each 
instance, the Vendor will be given 28 calendar days to remedy the issues. If, 
following the expiration of the 28 day period, the issues have not been resolved, 
the Vendor will be suspended from the Framework and removed from the 
Global Vendor List until all compliance failures have been remedied; 

o If this is the fourth time within a twelve month period that a breach has been 
identified, the Vendor will be suspended from the Global Vendor List with 
immediate effect for a minimum of 14 days and until all compliance failures 
have been remedied. 


In case you have further questions on any of the above, please do not hesitate to contact us 


at tcf.compliance@iabeurope.eu. 


Best regards, 


The IAB Europe Team 
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